Users can view unauthorised data via the sub-process form prefilled values

[theo-ritense]

Sensitive data can be leaked via the form prefill when starting a new process from an unauthorised case.
This is the specific vulnerable endpoint:

• /api/v1/process-definition/{processDefinitionId}/start-form?documentId={documentId}

Affected versions: Tested on next-minor (12.3.0), but presumably from > 11.0.0 onwards where PBAC was introduced.

Reproduction path on next-minor (local app/gzac instance):

• Login as admin
• create a case for leningen with an amount > 20000
• copy the url
• login as user
• Navigate to the copied URL
• Notice some errors while the button to start a sub-process is still available
• Start a sub-process Lening aanvragen
• Notice the form is prefilled with values the user should not have access to